Cannot push IKE gateway X variable using template (chicken or the egg)

[SteveBallantyne]

I have run into another 'bug' in 11.0.2 where my Palo Alto (PA-440) is trying to apply a configuration in an impossible order. Or, more likely, this is a Panorama bug of some sort.

Screenshot of gateway configuration:

Error message from the attempted push from Panorama:

• network -> ike -> gateway -> vpn-xxx-> local-address -> ip '74.xxx.xxx.xxx' is not a valid reference
• network -> ike -> gateway -> vpn-xxx -> local-address -> ip is invalid

The error is followed by a SLEW of other errors occurring in sort of a domino fashion.

The problem appears to be that this is a first time push to this device and the IP is invalid to be used for an IKE gateway, because it is not yet assigned to the interface of the PA-440. I opened a support case (02665364) and spent a few hours with support on the issue. But the best advice that they had was to remove the portion of the configuration that is causing the issue. I deleted the IP-Sec tunnel, and the IKE gateway. Then pushed the changes, and got success (verified that the public IP was applied to ethernet1/8 using the X variable . Then I created the IKE gateway with the same settings, and pushed the changes, and also got success. But ... this doesn't help me when I have 10 more devices that I need to configure, and I want to be able to push a VPN tunnel using Panorama and templates.

This appears to be a bug to me, so I am hoping that this gets picked up by engineering, etc?

[Leightonlee]

I resolved this by pushing the devices config first and then the templets.

[kylebrolafski]

The template which configured my VPN was already at the bottom of the stack.  Through the suggestion in this thread, I moved it to the top of the stack.  The VPN and the Variable are configured within the same template.

I will attempt to create a local configuration with the same naming on the device to let Panorama overwrite it.  The larger, yet unspoken issue I am trying to navigate here is having all of my routing completed in the same Template, due to the way the Stack overrides conflicts between Templates within the Stack.  Any changes from a single Template would be lost if another Template modified the same Virtual Router's configuration.